Why traffic log shows that traffic match allow policy but the result was reset by default deny policy?
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

The Enhanced LIVEcommunity Experience is finally here! Learn all about it.

Why traffic log shows that traffic match allow policy but the result was reset by default deny policy?

L2 Linker

Does anyone have following experience and could give me some idea to fix this issue?

 

Thanks a lot ~

 

I found sometimes the traffic log shows that traffic match allow policy but the result was reset by default deny policy.

 

For example:

 

I have a policy for allow some users to access TCP 58975.

圖片1.png

I checked traffic log and I found traffic be reset by interzone-default during 2/11 08:07:16 to 2/12 08:02:31

I already checked threat log and there is no log about drop or reset for this traffic.

And I checked configuration log and there is no change record.

圖片2.png圖片3.png

 

I have a clue, this PA-3020 update apps-content everyday at 8:00.

Traffic begin reset at 2/11 08:07:16 that just update to 8374-6528.

And after 24 hours traffic be allow at 2/12 08:02:31 that also just update to 8375-6541.

But I'm not sure is it can cause this problem because I think the policy allow any application so it should be allow if traffic match L3 to L4 rule. And I'm not sure that always happen after apps-content update in the first few times.

 

I have open a case but support says they need capture packets or they doesn't have enough data to analysis this issue.

That is problem because I can not reproduce this situation.

 

PA-3020

PAN-OS : 8.1.16

 

1 REPLY 1

Community Team Member

This is interesting..  

I see what you mean in your rules, dropped for about 24 hours.. then allowed again.

 

Questions:

 - Is this constant?  or was this a one time event? 

 - Have you seen this before?

 - It looks like you are just using Services and not apps? have you tried creating a custom app for this and allowing that application? Not sure that would matter.

 

LIVEcommunity team member
Stay Secure,
Joe
Don't forget to Like items!
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!